Isaca AAIA Practice Test 31
Question 300
An independent AI auditor reviews this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk. Which THREE elements together provide a defensible AI audit conclusion: the corrective control, the evidence to test it, and a verified outcome? Select THREE answers.
- Inspect data flows, prompt logs, retrieval chunks, masking controls and representative least-data tests.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
- Assume a strong encryption cipher alone establishes proportionality of invasive biometric collection.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
- Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Explanation
Correct Answers
D:The reason it is necessary is: High-impact monitoring of people can cause harm even when encryption and access controls are sound. For this situation: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
E:This evidence directly tests the asserted control for Privacy impact assessment for biometric AI: Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
F:This is an observable validation result for Privacy impact assessment for biometric AI, not just management assurance: Use case proceeds only with documented lawful purpose and proportionate risk treatment or is stopped.
Incorrect Answers
A:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
B:This option concerns Privacy by design for model features, which is a related but different AI governance concern. In this case: A campus introduces voice-emotion analytics for counseling appointments without examining false inference and privacy risk.
C:It misses the key control principle: High-impact monitoring of people can cause harm even when encryption and access controls are sound.
Question 301
A governance and assurance review uncovers the following: A European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Conduct a documented impact assessment of purpose, necessity, proportionality, alternatives and safeguards before deployment.
- Infer that data stays local solely from the vendor's billing address or local user interface.
- Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
- Minimize exposed attributes, redact unnecessary personal data and enforce purpose-bound access before model calls.
Explanation
Correct Answer
C:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. In this case: A European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements.
Incorrect Answers
A:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. It does not establish control effectiveness for Cross-border AI data transfer mapping.
B:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface.
D:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. It does not establish control effectiveness for Cross-border AI data transfer mapping.
Question 302
A risk-based audit engagement examines this operating condition: A European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Contractual no-training promises do not address independent log retention, indexing or deletion obligations.
- Generative fluency and predictive statistical accuracy address different tasks; auditors must test fitness for a defined business decision.
- Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
- Infer that data stays local solely from the vendor's billing address or local user interface.
Explanation
Correct Answer
C:Independent audit evidence includes: Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs. This is the applicable AI audit principle for Cross-border AI data transfer mapping: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
Incorrect Answers
A:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. It does not establish control effectiveness for Cross-border AI data transfer mapping.
B:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. It does not establish control effectiveness for Cross-border AI data transfer mapping.
D:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. For this situation: A European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements.
Question 303
An audit committee asks for a defensible assessment of this situation: A European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect data flows, prompt logs, retrieval chunks, masking controls and representative least-data tests.
- Infer that data stays local solely from the vendor's billing address or local user interface.
- Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
- Review data categories, stakeholder impacts, alternatives, lawful basis, accuracy and mitigation decisions.
Explanation
Correct Answer
C:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. This evidence directly tests the asserted control for Cross-border AI data transfer mapping: Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
Incorrect Answers
A:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. For this situation: A European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements.
B:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. The auditor should instead examine: Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
D:This option concerns Privacy impact assessment for biometric AI, which is a related but different AI governance concern. For this situation: A European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements.
Question 304
During an AI controls assessment, the team learns that a European payroll assistant routes sensitive prompts through an overseas model region contrary to approved transfer arrangements. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- Only permitted records enter the use case, with documented restrictions and review of new purposes.
- All material flows remain in approved places or have current transfer assessments and safeguards.
- Sampled denials have faithful understandable reasons, reliable escalation and documented accuracy versus simpler alternatives.
- Infer that data stays local solely from the vendor's billing address or local user interface.
Explanation
Correct Answer
B:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. This is an observable validation result for Cross-border AI data transfer mapping, not just management assurance: All material flows remain in approved places or have current transfer assessments and safeguards.
Incorrect Answers
A:This option concerns Purpose limitation in AI training data reuse, which is a related but different AI governance concern. It does not establish control effectiveness for Cross-border AI data transfer mapping.
C:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. It does not establish control effectiveness for Cross-border AI data transfer mapping.
D:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. Effective closure requires: All material flows remain in approved places or have current transfer assessments and safeguards.
Question 305
An independent AI auditor reviews this case: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Infer that data stays local solely from the vendor's billing address or local user interface.
- Define defensible retention, deletion and downstream propagation processes with technical evidence of execution.
- Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
- Minimize exposed attributes, redact unnecessary personal data and enforce purpose-bound access before model calls.
Explanation
Correct Answer
C:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. This is the proportionate control response to Cross-border AI data transfer mapping: Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
Incorrect Answers
A:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. In this case: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory.
B:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. The decisive principle here is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
D:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. The decisive principle here is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
Question 306
A governance and assurance review uncovers the following: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory. Which principle BEST explains why the observed practice is a material governance or control concern? Select ONE best answer.
- Data minimization reduces privacy exposure at input, storage, retrieval and telemetry stages.
- Infer that data stays local solely from the vendor's billing address or local user interface.
- Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
- Contractual no-training promises do not address independent log retention, indexing or deletion obligations.
Explanation
Correct Answer
C:Independent audit evidence includes: Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs. The corrective action is: Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
Incorrect Answers
A:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. For this situation: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory.
B:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. For this situation: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory.
D:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. For this situation: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory.
Question 307
A risk-based audit engagement examines this operating condition: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory. What evidence should the auditor examine FIRST to substantiate or challenge the control owner’s claim? Select ONE best answer.
- Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
- Inspect provider terms, retention schedules, index lifecycle, backups, deletion tickets and test identifiers.
- Compare use-case requirements, deterministic baselines, quantitative error rates, grounded outputs and exception handling.
- Infer that data stays local solely from the vendor's billing address or local user interface.
Explanation
Correct Answer
A:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. The corrective action is: Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
Incorrect Answers
B:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. The audit must corroborate: Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
C:This option concerns Predictive versus generative model task fit, which is a related but different AI governance concern. The decisive principle here is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
D:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
Question 308
An audit committee asks for a defensible assessment of this situation: A bank stores model telemetry in an undeclared subcontractor region with no current transfer inventory. After management addresses the issue, which result MOST convincingly demonstrates effective remediation? Select ONE best answer.
- All material flows remain in approved places or have current transfer assessments and safeguards.
- Infer that data stays local solely from the vendor's billing address or local user interface.
- Only permitted records enter the use case, with documented restrictions and review of new purposes.
- Deletion requests remove or appropriately constrain applicable copies within documented policy and legal requirements.
Explanation
Correct Answer
A:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. Independent audit evidence includes: Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
Incorrect Answers
B:It misses the key control principle: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
C:This option concerns Purpose limitation in AI training data reuse, which is a related but different AI governance concern. The decisive principle here is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
D:This option concerns AI inference retention and right-to-erasure handling, which is a related but different AI governance concern. A proportionate response is: Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
Question 309
During an AI controls assessment, the team learns that a hospital uses a cloud embedding service whose disaster recovery copies are placed outside approved jurisdictions. What is the MOST appropriate risk-based audit recommendation that addresses the root control weakness? Select ONE best answer.
- Infer that data stays local solely from the vendor's billing address or local user interface.
- Minimize exposed attributes, redact unnecessary personal data and enforce purpose-bound access before model calls.
- Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
- Require decision-level explanations proportionate to the use case, validated predictive benefit, documented limitations and a meaningful appeal path.
Explanation
Correct Answer
C:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. The acceptable verified outcome is: All material flows remain in approved places or have current transfer assessments and safeguards.
Incorrect Answers
A:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. In this case: A hospital uses a cloud embedding service whose disaster recovery copies are placed outside approved jurisdictions.
B:This option concerns Data minimization and PII in prompts, which is a related but different AI governance concern. The audit must corroborate: Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
D:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. The decisive principle here is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local.
Question 310
An independent AI auditor reviews this case: A hospital uses a cloud embedding service whose disaster recovery copies are placed outside approved jurisdictions. Which TWO complementary elements should the auditor seek: an effective corrective control and the most probative independent evidence? Select TWO answers.
- Inspect region endpoints, service architecture, contractual transfer mechanisms, subprocessor lists and logs.
- Test whether less identifying features or on-premises transformations satisfy the business purpose.
- Inspect use-case criticality, model comparison, reason-code fidelity, feature lineage, adverse-decision samples and appeal test results.
- Infer that data stays local solely from the vendor's billing address or local user interface.
- Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
Explanation
Correct Answers
A:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. In this case: A hospital uses a cloud embedding service whose disaster recovery copies are placed outside approved jurisdictions.
E:The reason it is necessary is: Model prompts, embeddings, logs and training datasets can be transferred even when the front-end appears local. This response fits the risk associated with Cross-border AI data transfer mapping: Map international processing locations and lawful transfer safeguards through vendors, subprocessors and backups.
Incorrect Answers
B:This option concerns Privacy by design for model features, which is a related but different AI governance concern. It does not establish control effectiveness for Cross-border AI data transfer mapping.
C:This option concerns Explainable credit-model selection for adverse decisions, which is a related but different AI governance concern. For this situation: A hospital uses a cloud embedding service whose disaster recovery copies are placed outside approved jurisdictions.
D:This attractive shortcut does not resolve the Cross-border AI data transfer mapping weakness: Infer that data stays local solely from the vendor's billing address or local user interface. For this situation: A hospital uses a cloud embedding service whose disaster recovery copies are placed outside approved jurisdictions.
